Vulnerability · Published Jan 28, 2025 · Assigned by VulDB

CVE-2025-0783pankajindevops scale API Endpoint access control

Medium 6.3

In plain English

A medium-severity improper access control in scale from pankajindevops. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 73.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as problematic, was found in pankajindevops scale up to 20241113. This affects an unknown part of the component API Endpoint. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.

Affected products (as reported)

Vendor	Product	Versions
pankajindevops	scale	20241113

Weakness: CWE-284, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

VDB-293907 | pankajindevops scale API Endpoint access control vdb-entry
VDB-293907 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
Submit #480350 | Scale@ https://github.com/pankajindevops/scale Project Management System latest Improper Access Controls third-party-advisory
https://docs.google.com/document/d/1FCJveTlXtJd8EJRW2-LXwuhno92JaVt3_98Iqrdoc6M/edit?tab=t.0#heading=h.bbpri264qnth related
https://drive.google.com/file/d/1KqzS5bMyPtgO9eIk_-que50tZU097RVi/view exploit